ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks

The ShinyHunters threat actor (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, leveraging URL encoding techniques to evade WAF rules and gain unauthorized access. Once inside, attackers deploy web shells and the SIDEEYE backdoor, establishing persistent footholds across higher education, government, and technology sectors. This incident highlights a critical over-reliance on WAF solutions as a sole defensive layer — WAFs can be circumvented through encoding tricks, making unpatched vulnerabilities just as exposed as if no WAF existed. It also underscores the urgent need for timely patching of internet-facing enterprise applications, which represent high-value targets for sophisticated threat actors.